Agent runtimeagenticcodingdocumentedunattended capable

Operational brief

Cursor

AI IDE with local and cloud agents, plus a coordinator for shared project context.

Choose it when

You want the agent inside the editor, with optional cloud/self-hosted machines.

Skip it when

You refuse a closed IDE, or you only want a terminal agent.

01 / Classification

Autonomy evidence

This is our classification, not a vendor badge. The record says what the product normally does. The gaps stay visible.

How we classify it

Tool use + multi-step plans, still human-gated per session.

Runs unattended

Yes — that capability is documented in this brief.

Trigger

User-started editor/cloud tasks normally; optional Projects schedules and Slack/PR subscriptions can start delegated work without a prompt. iOS remote control only reconnects to a local agent.

State

Cloud conversation state and artifacts persist for review/resume. Projects share context files across agents. VM snapshots have a separate rolling inactivity window, not transcript retention.

Tools

Cloud VMs run code and terminal tools, push a branch and open a draft PR. Auto-running commands don't imply every write gets a human confirmation.

Human control

A human reviews the draft PR before merge. Admins select repository scope and egress policy; triggering-user Git access further limits scope. Assign an operator to review runs and failures; docs don't establish automatic recovery for every scheduled task.

02 / Operations

Control reality

Useful agents eventually touch something real. This is the operational picture we have, not a promise hidden in a sales page.

Where it runs

Hosted Cloud Agents use VMs in Cursor's cloud; self-hosted machines are a separate documented execution option. iOS remote control leaves local agents on the same computer, which must stay on and online.

Data boundary

Cloud runs clone authorized code and store conversation state. Internet egress defaults on, with configurable restrictions. Transcripts default to indefinite retention; snapshots use a rolling 30-day inactivity window and can't be deleted on demand. Archive isn't transcript deletion.

Identity & permissions

Git-provider app installation grants chosen repositories, then the user links their own Git account; a Cloud Agent's reach is limited by that triggering user's existing access.

What it can write

repo files · shell · PRs

Surfaces

IDE · Cloud agents · CLI

Export / lock-in

Not recorded yet.

03 / Receipts

Evidence ledger

Here is what this brief is built on. “Documented” means we found a source. “Tested” means this desk actually ran it. Those are different things.

Evidence status

documented

Source set

3 primary sources

Evidence review

2026-10-14

Sources on file

Corrections

2026-10-14 · Clarified Oct6 iOS remote control as local execution, not a hosting change; separated Oct13 Origin integrations from runtime releases. Removed unsupported most-users language and added cloud approval, egress, identity and retention distinctions. Existing Projects desk-report date, self-hosted fit, covers and payloads retained; not runtime-tested.

Desk notes

What we found

Useful context, not a substitute for the source record above. This is not a desk test unless the evidence status says tested.

Keep local remote control, cloud runs and self-hosted execution distinct; review cloud permissions and retention before delegating.

Remote control

iOS; local computer stays on and online

Cloud writes

Auto-run terminal; human draft-PR handoff

Egress

Internet on by default; configurable restrictions

Retention

Transcripts indefinite by default; snapshots 30-day inactivity

What the vendor says

Security docs describe authorized Git scope, persisted cloud state and distinct archive, transcript deletion and snapshot expiry.

Sources fetched 2026-10-14

04 / Change log

Related coverage

The brief tells you what the product is. Payloads track the changes that may alter the decision.